fabookie | 7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7

Analysis

max time kernel
150s
max time network
153s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
18/09/2023, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe
Size

261KB
MD5

f0700807596ea2564f5d74ce6183342c
SHA1

5d9fc132ce7beb9b9135fd2510f3905a186721ce
SHA256

7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7
SHA512

1756b2f3f9a32b5c1ba5fbe56ee366e5b3079457925839215c514252ee0b73308ded3e2fa4c24aa07bc899b3d80ea8d03123ac7dd24e12d036bdbe899d493149
SSDEEP

6144:pGvJm09zORs+z/TMify9DAOoqQDd8V4u8/:puw09CK5NdgdVu8/

Score

10^/10

fabookie redline smokeloader 0305 backdoor google discovery infostealer phishing spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

0305

185.215.113.25:10195

Attributes

auth_value
c86205ff1cc37b2da12f0190adfda52c

Signatures

Detect Fabookie payload 2 IoCs

resource	yara_rule
behavioral1/memory/3620-122-0x0000000002C50000-0x0000000002D81000-memory.dmp	family_fabookie
behavioral1/memory/3620-511-0x0000000002C50000-0x0000000002D81000-memory.dmp	family_fabookie

Detected google phishing page
phishing google
Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 4 IoCs

pid	Process
1580	91EA.exe
2644	93B1.exe
604	997E.exe
3620	9C6D.exe

Loads dropped DLL 2 IoCs

pid	Process
4464	rundll32.exe
4028	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 528 set thread context of 2868	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	73

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "401166744"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 00ddfb6e0bead901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e103e009d9e9d901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 64abbb0fd9e9d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings	997E.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2204032094-4125186646-761438227-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2868	AppLaunch.exe
2868	AppLaunch.exe
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3328	Process not Found

Suspicious behavior: MapViewOfSection 13 IoCs

pid	Process
2868	AppLaunch.exe
5048	MicrosoftEdgeCP.exe
5048	MicrosoftEdgeCP.exe
5048	MicrosoftEdgeCP.exe
5048	MicrosoftEdgeCP.exe
5048	MicrosoftEdgeCP.exe
5048	MicrosoftEdgeCP.exe
5048	MicrosoftEdgeCP.exe
5048	MicrosoftEdgeCP.exe
5048	MicrosoftEdgeCP.exe
5048	MicrosoftEdgeCP.exe
5048	MicrosoftEdgeCP.exe
5048	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeDebugPrivilege	1580	91EA.exe
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeDebugPrivilege	3480	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3480	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3480	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3480	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeDebugPrivilege	2644	93B1.exe
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeDebugPrivilege	2740	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2740	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1592	MicrosoftEdge.exe
5048	MicrosoftEdgeCP.exe
3480	MicrosoftEdgeCP.exe
5048	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 1420	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	70
PID 528 wrote to memory of 1420	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	70
PID 528 wrote to memory of 1420	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	70
PID 528 wrote to memory of 3756	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	71
PID 528 wrote to memory of 3756	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	71
PID 528 wrote to memory of 3756	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	71
PID 528 wrote to memory of 4892	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	72
PID 528 wrote to memory of 4892	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	72
PID 528 wrote to memory of 4892	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	72
PID 528 wrote to memory of 2868	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	73
PID 528 wrote to memory of 2868	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	73
PID 528 wrote to memory of 2868	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	73
PID 528 wrote to memory of 2868	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	73
PID 528 wrote to memory of 2868	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	73
PID 528 wrote to memory of 2868	528	7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe	73
PID 3328 wrote to memory of 1580	3328	Process not Found	74
PID 3328 wrote to memory of 1580	3328	Process not Found	74
PID 3328 wrote to memory of 1580	3328	Process not Found	74
PID 3328 wrote to memory of 2644	3328	Process not Found	75
PID 3328 wrote to memory of 2644	3328	Process not Found	75
PID 3328 wrote to memory of 2644	3328	Process not Found	75
PID 3328 wrote to memory of 604	3328	Process not Found	77
PID 3328 wrote to memory of 604	3328	Process not Found	77
PID 3328 wrote to memory of 604	3328	Process not Found	77
PID 3328 wrote to memory of 3620	3328	Process not Found	78
PID 3328 wrote to memory of 3620	3328	Process not Found	78
PID 604 wrote to memory of 2776	604	997E.exe	79
PID 604 wrote to memory of 2776	604	997E.exe	79
PID 604 wrote to memory of 2776	604	997E.exe	79
PID 2776 wrote to memory of 4464	2776	control.exe	81
PID 2776 wrote to memory of 4464	2776	control.exe	81
PID 2776 wrote to memory of 4464	2776	control.exe	81
PID 3328 wrote to memory of 1840	3328	Process not Found	82
PID 3328 wrote to memory of 1840	3328	Process not Found	82
PID 4464 wrote to memory of 5100	4464	rundll32.exe	94
PID 4464 wrote to memory of 5100	4464	rundll32.exe	94
PID 5100 wrote to memory of 4028	5100	WerFault.exe	90
PID 5100 wrote to memory of 4028	5100	WerFault.exe	90
PID 5100 wrote to memory of 4028	5100	WerFault.exe	90
PID 5048 wrote to memory of 2076	5048	MicrosoftEdgeCP.exe	91
PID 5048 wrote to memory of 2076	5048	MicrosoftEdgeCP.exe	91
PID 5048 wrote to memory of 2076	5048	MicrosoftEdgeCP.exe	91
PID 5048 wrote to memory of 2076	5048	MicrosoftEdgeCP.exe	91
PID 5048 wrote to memory of 2076	5048	MicrosoftEdgeCP.exe	91
PID 5048 wrote to memory of 2076	5048	MicrosoftEdgeCP.exe	91
PID 5048 wrote to memory of 2076	5048	MicrosoftEdgeCP.exe	91
PID 5048 wrote to memory of 2076	5048	MicrosoftEdgeCP.exe	91
PID 5048 wrote to memory of 3356	5048	MicrosoftEdgeCP.exe	97
PID 5048 wrote to memory of 3356	5048	MicrosoftEdgeCP.exe	97
PID 5048 wrote to memory of 3356	5048	MicrosoftEdgeCP.exe	97
PID 5048 wrote to memory of 5100	5048	MicrosoftEdgeCP.exe	102
PID 5048 wrote to memory of 5100	5048	MicrosoftEdgeCP.exe	102
PID 5048 wrote to memory of 5100	5048	MicrosoftEdgeCP.exe	102
PID 5048 wrote to memory of 5100	5048	MicrosoftEdgeCP.exe	102
PID 5048 wrote to memory of 5100	5048	MicrosoftEdgeCP.exe	102
PID 5048 wrote to memory of 5100	5048	MicrosoftEdgeCP.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe
"C:\Users\Admin\AppData\Local\Temp\7ea1f2986a2ace0300bdca8290466b31f895b48311d738e58ef70bb427bb40d7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4892
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2868

C:\Users\Admin\AppData\Local\Temp\91EA.exe
C:\Users\Admin\AppData\Local\Temp\91EA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Users\Admin\AppData\Local\Temp\93B1.exe
C:\Users\Admin\AppData\Local\Temp\93B1.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Users\Admin\AppData\Local\Temp\997E.exe
C:\Users\Admin\AppData\Local\Temp\997E.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:604
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\TTH_S.CpL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\TTH_S.CpL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\TTH_S.CpL",
      4⤵
      PID:5100
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\TTH_S.CpL",
        5⤵
        Loads dropped DLL
        
        PID:4028

C:\Users\Admin\AppData\Local\Temp\9C6D.exe
C:\Users\Admin\AppData\Local\Temp\9C6D.exe
1⤵
- Executes dropped EXE
PID:3620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9E43.bat" "
1⤵
- Checks computer location settings
PID:1840

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1592

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3928

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3480

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2076

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1520 -s 3408
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5100

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3940

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3356

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4860

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5100

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PZQ0K35H\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\M0GDIIZE\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\YLJN6Z3H\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\1ZTGEIBC.cookie

Filesize
131B

MD5
4c3187c40d15090c0ef8279b7768d526

SHA1
be2f5b674d39d39c92749f008fdf30dcee5ef612

SHA256
bd85bd960895bcd59cf860e09470c57e0287afb2f6538e448c5eedc5e0278a19

SHA512
bdad2919d0f9cf9fecc4e5ed30fbc14646e711666da00f7b0ce15a108f7f0fdf7dabbd6017dc5a9d39d78663046862694f8f49bcc320f22e0c5671fd9e59f1c7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
5d13c93c1ffbc325327f9848b8346003

SHA1
0a2678ebe23dfeea13cb8f529f55ac0cac436054

SHA256
54836d31af906348184544664235fc815918029551f45ac159369ebc3aa570c4

SHA512
7688770276507d81af8b683753af694ece3eca88285022d544da6c1647d11ba69f6f3312f42f05115ac2b7bd40b5c6c14093e99fa31db60a7d864a6c1c1130ed

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_BA0BAB2D4C396325C2233CA4C6557724

Filesize
472B

MD5
149a7377ce505162af15127c384d5e3b

SHA1
f4bf765455a03741b3c401204af7aadc8356e4a4

SHA256
f6731d465327021f3b3ced0bb1087faf90bf1d7b7619edb8b94dbf3f80fd3f43

SHA512
06ea8e0a9348ff73c0ca08ffde9ca5747697f80b61ae5f83e28c8ad54320398b9e9bc3a3d892921c9beb6ce55ebf7c910dbcd99bfec178b710f5e6a55fca522d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
aa62f8ce77e072c8160c71b5df3099b0

SHA1
06b8c07db93694a3fe73a4276283fabb0e20ac38

SHA256
3eb4927c4d9097dc924fcde21b56d01d5d1ef61b7d22bfb6786e3b546b33e176

SHA512
71724e837286c5f0eb2ee4ad01ac0304d4c7597bb2d46169c342821b0da04d8597491bd27ef80e817bc77031cd29d2182ccc82ef8ea3860696875f89427c8e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
e9229ad8df96c55ec2485b93dd6bbfa4

SHA1
84d145cca4b171f6376a208f2e0de3c4b5d7260e

SHA256
80b6a5914f70fcd00a34098e7aa3c3ca7819cc2a85438c7f5a7ffda7ec4fa214

SHA512
d91201105886572f2254996f2532798a60d5d126c64b0acea2a268563814dd4c3ab5ddcd8a6cd7ead7b174d160deb8bc0520b97e5e86c94ddccac806c15e98bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_BA0BAB2D4C396325C2233CA4C6557724

Filesize
410B

MD5
196b18f5992f21bee55caad4c9f68f5d

SHA1
e425be34a0edf233db395817ead2f38f6e99ca41

SHA256
411153579fc8ea5b49ada981e10da090a2cb8ca09ec957f0fa4b5f9a2f759cb1

SHA512
9b06641c60fcf58230210d8e6865db843e2bd984a2c207b0ed5a3af9517f137fcd88e276342ca24c17c975f46d061d0ae2d197a8867950a4e729c7414a7258a6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
c2e9b7f78910f763aa11345f9a180a24

SHA1
7061ad3791437521dea2024816cf5908e4b0cf48

SHA256
3c586d5725718683e15a1f14b12904c5f2eaa229705084eb2b8d808f4c41b599

SHA512
b4faa932249689f5d3273ad857489b997c14249f20e66ccdb727badb35b3bc997fdaa1473ef51e4181fcc1dcba7351d9e860da3f052c3d8e7e8a869c561c3491

Download Submit
C:\Users\Admin\AppData\Local\Temp\91EA.exe

Filesize
341KB

MD5
8669fe397a7225ede807202f6a9d8390

SHA1
04a806a5c4218cb703cba85d3e636d0c8cbae043

SHA256
1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e

SHA512
29cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\91EA.exe

Filesize
341KB

MD5
8669fe397a7225ede807202f6a9d8390

SHA1
04a806a5c4218cb703cba85d3e636d0c8cbae043

SHA256
1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e

SHA512
29cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\93B1.exe

Filesize
412KB

MD5
5200fbe07521eb001f145afb95d40283

SHA1
df6cfdf15b58a0bb24255b3902886dc375f3346f

SHA256
00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

SHA512
c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\93B1.exe

Filesize
412KB

MD5
5200fbe07521eb001f145afb95d40283

SHA1
df6cfdf15b58a0bb24255b3902886dc375f3346f

SHA256
00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

SHA512
c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\997E.exe

Filesize
1.7MB

MD5
f4b73d1ecd694774def8745b6c23d92a

SHA1
939bc5f546bd2d01caa1c31271fed6f26a252c8a

SHA256
4e59dd063fcc1f7746d1229cd1ccdaf7518a6f908325e9a60e2427b2fd89c59c

SHA512
24de51cb2fa7091ead36f23de78367769a31143ab36d676e156704c826166b3dfc4e12a38d51b06fbc20dbcc7ae41c2be6200e6bb29a75924c9f9738daea1393

Download Submit
C:\Users\Admin\AppData\Local\Temp\997E.exe

Filesize
1.7MB

MD5
f4b73d1ecd694774def8745b6c23d92a

SHA1
939bc5f546bd2d01caa1c31271fed6f26a252c8a

SHA256
4e59dd063fcc1f7746d1229cd1ccdaf7518a6f908325e9a60e2427b2fd89c59c

SHA512
24de51cb2fa7091ead36f23de78367769a31143ab36d676e156704c826166b3dfc4e12a38d51b06fbc20dbcc7ae41c2be6200e6bb29a75924c9f9738daea1393

Download Submit
C:\Users\Admin\AppData\Local\Temp\9C6D.exe

Filesize
298KB

MD5
8bd874c0500c7112d04cfad6fda75524

SHA1
d04a20e3bb7ffe5663f69c870457ad4edeb00192

SHA256
22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

SHA512
d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\9C6D.exe

Filesize
298KB

MD5
8bd874c0500c7112d04cfad6fda75524

SHA1
d04a20e3bb7ffe5663f69c870457ad4edeb00192

SHA256
22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

SHA512
d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\9E43.bat

Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\TTH_S.CpL

Filesize
1.4MB

MD5
028a895fe4243df61e6ff0498b1aae5a

SHA1
04913165a71926f1e71e059de52045851620dcbc

SHA256
0ad28ab50f4d26548985afb3104d319d8daafb78428794efc305ed71f827a028

SHA512
551f5349de96c23004c896163a3a66ac6908c0feeb96e85bc68254f63f3efd6fb8d0487999b2b7ade6331a1626ec1d7ceed1d1afe9707df3cc1b445b230c487a

Download Submit
\Users\Admin\AppData\Local\Temp\TTh_S.cpl

Filesize
1.4MB

MD5
028a895fe4243df61e6ff0498b1aae5a

SHA1
04913165a71926f1e71e059de52045851620dcbc

SHA256
0ad28ab50f4d26548985afb3104d319d8daafb78428794efc305ed71f827a028

SHA512
551f5349de96c23004c896163a3a66ac6908c0feeb96e85bc68254f63f3efd6fb8d0487999b2b7ade6331a1626ec1d7ceed1d1afe9707df3cc1b445b230c487a

Download Submit
\Users\Admin\AppData\Local\Temp\TTh_S.cpl

Filesize
1.4MB

MD5
028a895fe4243df61e6ff0498b1aae5a

SHA1
04913165a71926f1e71e059de52045851620dcbc

SHA256
0ad28ab50f4d26548985afb3104d319d8daafb78428794efc305ed71f827a028

SHA512
551f5349de96c23004c896163a3a66ac6908c0feeb96e85bc68254f63f3efd6fb8d0487999b2b7ade6331a1626ec1d7ceed1d1afe9707df3cc1b445b230c487a

Download Submit
memory/1580-22-0x0000000007AD0000-0x0000000007B62000-memory.dmp

Filesize
584KB

Download
memory/1580-16-0x0000000073310000-0x00000000739FE000-memory.dmp

Filesize
6.9MB

Download
memory/1580-120-0x0000000073310000-0x00000000739FE000-memory.dmp

Filesize
6.9MB

Download
memory/1580-27-0x0000000007CC0000-0x0000000007CD2000-memory.dmp

Filesize
72KB

Download
memory/1580-25-0x0000000007A90000-0x0000000007A9A000-memory.dmp

Filesize
40KB

Download
memory/1580-24-0x0000000007CB0000-0x0000000007CC0000-memory.dmp

Filesize
64KB

Download
memory/1580-28-0x0000000007E10000-0x0000000007F1A000-memory.dmp

Filesize
1.0MB

Download
memory/1580-54-0x0000000008560000-0x00000000085C6000-memory.dmp

Filesize
408KB

Download
memory/1580-21-0x0000000007F30000-0x000000000842E000-memory.dmp

Filesize
5.0MB

Download
memory/1580-26-0x0000000008A40000-0x0000000009046000-memory.dmp

Filesize
6.0MB

Download
memory/1580-31-0x0000000007D80000-0x0000000007DCB000-memory.dmp

Filesize
300KB

Download
memory/1580-15-0x0000000000D10000-0x0000000000D6A000-memory.dmp

Filesize
360KB

Download
memory/1580-212-0x0000000073310000-0x00000000739FE000-memory.dmp

Filesize
6.9MB

Download
memory/1580-82-0x0000000009BE0000-0x0000000009C56000-memory.dmp

Filesize
472KB

Download
memory/1580-88-0x0000000009BA0000-0x0000000009BBE000-memory.dmp

Filesize
120KB

Download
memory/1580-130-0x000000000B430000-0x000000000B95C000-memory.dmp

Filesize
5.2MB

Download
memory/1580-127-0x000000000AD30000-0x000000000AEF2000-memory.dmp

Filesize
1.8MB

Download
memory/1580-29-0x0000000007D20000-0x0000000007D5E000-memory.dmp

Filesize
248KB

Download
memory/1592-108-0x000001CAE00F0000-0x000001CAE00F2000-memory.dmp

Filesize
8KB

Download
memory/1592-89-0x000001CAE1500000-0x000001CAE1510000-memory.dmp

Filesize
64KB

Download
memory/1592-71-0x000001CAE0D20000-0x000001CAE0D30000-memory.dmp

Filesize
64KB

Download
memory/2076-421-0x00000262F1870000-0x00000262F1872000-memory.dmp

Filesize
8KB

Download
memory/2076-424-0x00000262F1890000-0x00000262F1892000-memory.dmp

Filesize
8KB

Download
memory/2076-415-0x00000262F1400000-0x00000262F1500000-memory.dmp

Filesize
1024KB

Download
memory/2076-404-0x00000262F0AB0000-0x00000262F0AB2000-memory.dmp

Filesize
8KB

Download
memory/2076-290-0x00000262EFD40000-0x00000262EFD60000-memory.dmp

Filesize
128KB

Download
memory/2076-282-0x00000262F0910000-0x00000262F0A10000-memory.dmp

Filesize
1024KB

Download
memory/2644-210-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Filesize
64KB

Download
memory/2644-64-0x0000000004CF0000-0x0000000004D00000-memory.dmp

Filesize
64KB

Download
memory/2644-52-0x00000000001D0000-0x0000000000200000-memory.dmp

Filesize
192KB

Download
memory/2644-59-0x0000000073310000-0x00000000739FE000-memory.dmp

Filesize
6.9MB

Download
memory/2644-151-0x000000000B250000-0x000000000B2A0000-memory.dmp

Filesize
320KB

Download
memory/2644-152-0x0000000073310000-0x00000000739FE000-memory.dmp

Filesize
6.9MB

Download
memory/2644-515-0x0000000073310000-0x00000000739FE000-memory.dmp

Filesize
6.9MB

Download
memory/2644-61-0x0000000002510000-0x0000000002516000-memory.dmp

Filesize
24KB

Download
memory/2868-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2868-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2868-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3328-4-0x0000000001250000-0x0000000001266000-memory.dmp

Filesize
88KB

Download
memory/3620-43-0x00007FF673340000-0x00007FF67338E000-memory.dmp

Filesize
312KB

Download
memory/3620-122-0x0000000002C50000-0x0000000002D81000-memory.dmp

Filesize
1.2MB

Download
memory/3620-121-0x0000000002AD0000-0x0000000002C41000-memory.dmp

Filesize
1.4MB

Download
memory/3620-511-0x0000000002C50000-0x0000000002D81000-memory.dmp

Filesize
1.2MB

Download
memory/4028-125-0x0000000000D70000-0x0000000000D76000-memory.dmp

Filesize
24KB

Download
memory/4028-141-0x0000000004A40000-0x0000000004B3C000-memory.dmp

Filesize
1008KB

Download
memory/4028-154-0x0000000004B40000-0x0000000004C23000-memory.dmp

Filesize
908KB

Download
memory/4028-148-0x0000000004B40000-0x0000000004C23000-memory.dmp

Filesize
908KB

Download
memory/4028-145-0x0000000004B40000-0x0000000004C23000-memory.dmp

Filesize
908KB

Download
memory/4464-113-0x0000000001290000-0x0000000001373000-memory.dmp

Filesize
908KB

Download
memory/4464-50-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/4464-51-0x0000000010000000-0x0000000010165000-memory.dmp

Filesize
1.4MB

Download
memory/4464-116-0x0000000001290000-0x0000000001373000-memory.dmp

Filesize
908KB

Download
memory/4464-117-0x0000000001290000-0x0000000001373000-memory.dmp

Filesize
908KB

Download
memory/4464-109-0x0000000001190000-0x000000000128C000-memory.dmp

Filesize
1008KB

Download